In this section, we first describe MR and MRT in our scheme EVRQ. Then, we introduce MR encoding. Finally, we present the construction of the EVRQ scheme in detail.
5.1. Map Region (MR) and Map Region Tree (MRT)
Suppose there are n POIs which are distributed in an MR. These POIs are denoted by , , …, , respectively. The DO divides this MR into multiple MRs. Each MR is associated with a level number, and the MRs with the same level number contain the same or a similar number of POIs. The generation process of MRs is as follows.
Firstly, the DO uses the notation to denote the whole MR. is the first-level MR, which covers all the POIs in the whole MR. The superscript of represents the level of and the subscript represents the order of within its level.
Secondly, the DO divides into two parts by a vertical line. The left part is denoted by , and the right part is denoted by . If the total number of POIs in is even, then the DO sets the total number of POIs in to be equal to that in . If the total number of POIs in is odd, then the DO sets the total number of POIs in to be one more than that in .
Thirdly, the DO divides into two parts by a horizontal line. The upper part is denoted by , and the lower part is denoted by . If the total number of POIs in is even, then the DO sets the total number of POIs in to be equal to that in . If the total number of POIs in is odd, then the DO sets the total number of POIs in to be one more than that in . The DO also divides into two parts by another horizontal line. The upper part is denoted by , and the lower part is denoted by . In the same way, if the total number of POIs in is even, then the DO sets the total number of POIs in to be equal to that in . If the total number of POIs in is odd, then the DO sets the total number of POIs in to be one more than that in .
According to the method of MR division above, is divided into four MRs: , , , and , respectively. For the sake of convenience, these four MRs are denoted by , , , and , respectively. The superscript 2 represents the level of these MRs and the subscripts 1, 2, 3, and 4 represent the order of these MRs within level 2.
Finally, the DO divides , , , and iteratively until each MR contains only a single POI.
According to the method of the MR division above, it is easy to observe two facts: (1) most MRs within the same level contain an equal (or a similar) number of POIs. Specifically, the difference in the number of POIs contained in different MRs is at most one; (2) when different MRs contain an equal (or a similar) number of POIs, an attacker cannot effectively distinguish these MRs according to the number of POIs they contain. Therefore, an attacker (including the untrusted CS) cannot infer the query privacy of the DU by observing the DU’s query process on different MRs and analyzing the density distribution of POIs in different MRs.
In the following Example 1, we demonstrate our method for MR division.
Example 1. Figure 2 (1) shows the first-level MR, denoted by , which contains 17 gas stations (17 POIs). Firstly, the DO divides into two parts, and , by a vertical line. contains 9 gas stations (), while contains 8 gas stations (). Then, the DO further divides into two parts, and , by a horizontal line. Similarly, the DO divides into two parts, and , by another horizontal line. As shown in Figure 2 (2), contains 4 gas stations (), contains 4 gas stations (), contains 5 gas stations (), and contains 4 gas stations (). Then, the DO divides these second-level MRs—, , , and —iteratively. As shown in Figure 2 (3), the DO obtains the third-level MRs: . Each third-level MR (except for ) contains only one gas station. Thus, the DO stops further dividing these third-level MRs. As contains 2 gas stations (), the DO continues to divide . As shown in Figure 2 (4), the DO obtains the fourth-level MRs ( only contains one gas station ) and ( only contains one gas station). As and only contain one gas station, the DO stops dividing and . To construct an MRT, the DO firstly constructs a quadtree and processes the quadtree by using the MRs. In the quadtree, the DO associates the first-level node (i.e., the root node) with the MR that contains all the POIs. Secondly, the DO divides into four MRs () that contain the same (or a similar) number of POIs. The DO associates the second-level nodes (i.e., the child nodes of the root node) with the MRs , respectively. Then, the DO continues to divide into sixteen MRs that contain the same (or a similar) number of POIs, and then associates the third-level nodes of the quadtree with these MRs (). By using the same method, the DO processes the quadtree in a top–down manner. Finally, the DO associates each leaf node of the MRT with an MR that contains only one POI. After processing each node of the quadtree, the DO obtains the MRT. Note that, in our scheme, there is no intersection between the POIs contained in different MRs that are associated with the same level nodes in the MRT.
Figure 3 shows the MRT that is constructed by using the MRs in
Figure 2. As shown in
Figure 3, each node is associated with an MR (
,
, etc.), and each leaf node is associated with an MR that contains only one POI (
,
, etc.). By observing the MRT, it is easy to observe the following: (1) as the depth difference between leaf nodes is at most one, the MRT is a balanced tree. Therefore, the MRT supports fast traversal. (2) As the MRs of the same level contain an equal (or similar) number of POIs, the structures of the corresponding subtrees are the same (or similar). Thus, it is difficult to effectively distinguish different MRs of the same level and their corresponding subtrees. This feature ensures that the density distribution information of POIs remains protected. Therefore, an attacker (including the untrusted CS) cannot infer the DU’s query privacy by observing the DU’s query process on the MRT and analyzing the density distribution information of POIs on a map.
5.2. Map Region (MR) Encoding
As shown in
Figure 4, an MR
M can be represented by the minimum point
and the maximum point
. Therefore, the encoding of
M can be represented by the encodings of
,
,
, and
. The encoding process of
,
,
, and
is as follows.
Firstly, the DO encodes , , , and to t-length binary strings (t is a large-enough positive integer), denoted by , , , and , respectively.
Secondly, the DO generates random numbers , , , and for , , , and , respectively. Finally, the DO encodes these random numbers to t-length binary strings, denoted by , , , and , respectively. These random numbers , , , and are used to randomize the boundary information , , , and of MR while ensuring comparability between them.
Then, the DO concatenates the above binary strings to obtain , , , and , where denotes concatenation operation. Note that the above processes for binary strings still preserve the ordering relationship between the data. For example, as and , there are and .
Finally, the DO calculates the 0-encodings of
and
, denoted by
and
, respectively. The DO calculates the 1-encodings of
and
, denoted by
and
, respectively. The DO uses
,
,
, and
as the MR encoding of
M in
Figure 4.
5.3. Efficient and Verifiable Range Query Scheme (EVRQ)
5.3.1. System Setup
Firstly, the DO randomly chooses a number as the key
k. Then, the DO sets a security parameter
and executes the algorithm
in [
32], which outputs a secret key
and a public key
. Next, the DO sets four tagging parameters
,
,
, and
and selects
w hash keys
used for the hash function in a Bloom filter. Finally, the DO keeps
secretly; the DO also sends the tagging parameters
,
,
, and
; hash keys
; and the key
k to the DU, and publishes
.
5.3.2. Map Region Tree (MRT) Index Construction
Firstly, we represent the method for processing a node in MRT. Then, we introduce the method for constructing an MRT index.
1. Node Processing in MRT. To facilitate explanation, we assume that
N is a node in MRT, and
N is associated with an MR
M, which is represented by
,
,
, and
(see
Section 5.2).
The DO converts to by using the key k and a secure hash function (such as SHA families), where and represent the concatenation operation. Similarly, the DO converts , , and to (where ), (where ), and (where ), respectively. During the conversion process, tagging parameters , , , and are padded after each element in , , , and , respectively. This ensures that , , , and are disjoint with each other.
The DO computes the union set
and executes the algorithm
in [
32]. This algorithm outputs the accumulated value of all elements in
, denoted by
.
The DO selects an l-length binary string, denoted by (each bit of is initialized to 0). For each element , the DO calculates hash values , , …, and sets the corresponding positions in to 1.
2. MRT index Construction. As the CS is considered to be untrusted in our scheme EVRQ, the CS may selectively query only a portion of the data to save computational resources, and even illegally modify the data and the index stored in the CS. To prevent such malicious operations, the DO needs to generate hash values for each node in an MRT index. By using the hash values of the MRT index, the DU can verify that the CS has traversed the entire MRT index and has not made any illegal modifications to the geographical data and the MRT index stored in the CS. The generation of hash values in the MRT index is as follows.
Suppose that
N is a leaf node in the MRT,
N is associated with an MR
M which contains only one POI, denoted by
s. Firstly, the DO uses a secure encryption method, such as AES [
34], to encrypt
s and securely distributes the decryption key to the DU. The ciphertext of
s is denoted by
. Secondly, the DO calculates
,
, and
(see
Section 5.3.2). Then, the DO computes the hash value of
N, which is
(⊕ represents the XOR operation). Finally, the DO stores
,
,
,
, and
in the leaf node
N.
Suppose that
N is an internal node in the MRT, and
N is associated with an MR
M. There are four child nodes
,
,
, and
of
N. The hash values of
,
,
, and
are
,
,
, and
, respectively. Firstly, the DO calculates
,
, and
(see
Section 5.3.2). Then, the DO computes
and computes
. Finally, the DO stores
,
,
, and
in the internal node
N.
Note that some internal nodes may not have four child nodes. In such cases, the DO only needs to use the hash values of all the child nodes of the internal node to compute the hash value of the internal node. For example, as shown in
Figure 3, the internal node
has only two child nodes (leaf nodes)
and
.
is associated with MR
. In this case, the DO computes the hash values
and
. Then, the DO stores
,
,
,
, and
in the internal node
.
After the DO adds the aforementioned information to each MRT node, the MRT index is constructed.
5.3.3. Query Token Generation
Firstly, for a queried range Q, the DU represents Q by using the minimum point and the maximum point . The DU converts , , , and to t-length binary strings, denoted by , , , and , respectively. Secondly, the DU randomly chooses numbers , , , and for , , , and , respectively, and also converts these random numbers to t-length binary strings, denoted by , , , and , respectively. Then, the DU calculates 0-encodings for and , denoted by and , respectively. The DU calculates 1-encodings for and , denoted by and , respectively. Thus, the encoding of Q is represented by , , , and .
Secondly, to determine whether the queried range
Q intersects with an MR
M, the CS should determine whether
intersects with
,
intersects with
,
intersects with
, and
intersects with
(see
Section 5.3.4). Thus, the DO calculates
(where
),
(where
),
(where
), and
(where
).
Finally, the DU executes the algorithm
in [
32], which outputs the accumulated value of all elements in
, denoted by
. Using the same method, the DU can obtain the accumulated value of all elements in
,
, and
, denoted by
,
and
, respectively. The DU sends
,
,
,
, and their corresponding accumulated values
,
,
, and
as the query token to the CS.
5.3.4. Range Query
In this section, we first transform the operation of determining the positional relationship between Q and M into the operation of comparing two values in Q and M. Then, we utilize the 0–1 encoding technique to convert the operation of comparing the values into the operation of determining whether two different sets intersect. We add the tags , , , and to the elements in these sets. This allows for the CS to find the sets and then correctly perform the set intersection operations.
As shown in
Figure 4, the MR
M of a node
N can be represented by the minimum point
and the maximum point
. Similarly, the queried range
Q can be represented by the minimum point
and the maximum point
. As shown in
Figure 5 (1)–(4), if
, there are four possible positional relationships between
Q and
M:
Figure 5 (1) shows that
Q is positioned to the right of
M, which indicates
;
Figure 5 (2) shows that
Q is positioned to the left of
M, which indicates
;
Figure 5 (3) shows that
Q is positioned above
M, which indicates
;
Figure 5 (4) shows that
Q is positioned below
M, which indicates
.
According to 0–1 encoding, if , there is . Note that (where ) and (where ). Thus, if , there is . Note that (where ), (where ), and (where ). As the tagging parameters are different, there is no element in , and that is the same as any element in . It is easy to know that , and . Thus, we have the conclusion that if , there is , where . According to the above analysis, we have the following conclusions.
(corresponds to a positional relationship in
Figure 5 (1));
(corresponds to a positional relationship in
Figure 5 (2));
(corresponds to a positional relationship in
Figure 5 (3));
(corresponds to a positional relationship in
Figure 5 (4)), where
.
Therefore, if the CS determines that , , , or , then there is .
The CS extracts , , , and from the query token of Q and extracts from the node N in the MRT index. If , , , or , then the CS determines and stops querying the descendant nodes of N in the MRT index. Otherwise, the CS continues querying the descendant nodes of N in the MRT index. The CS begins determining from the root node to the leaf nodes in the MRT index. Finally, it retrieves the encrypted POIs in the leaf nodes, which meet the query request of the DU. These retrieved ciphertexts of POIs are then returned to the DU as the query results.
5.3.5. Verification of Correctness and Entirety in the Query Process
To verify the correctness and entirety in the query process, the DU can request relevant information from the CS.
Suppose N is a node in the MRT index, which is associated with an MR M. In the query process, if the CS determines , the DU can request the CS to provide a proof as follows.
The CS extracts the binary string
from the node
N and sends it to the DU. Upon receiving
, the DU extracts each element
a from
in the query token and calculates hash values
,
, …,
. Then, the DU checks if the values at the positions of all hash values in
are 1. If there is no such element
a, it means that
. Then, the DU can verify
. Similarly, the DU can also determine whether
, or
, or
by using
, and then verify
. Otherwise,
fails to verify
. This could be due to false positive errors in the Bloom filter, and the probability of such false positives occurring is very low [
33]. Thus, the DU requests other information from the CS to verify
. The CS extracts
in the query token and
in the node
N. Then, the CS executes the algorithm
in [
32], and then obtains the proof
that represents the relationship between
and
. Similarly, the CS can obtain the proof
that represents the relationship between
and
, the proof
that represents the relationship between
and
, and the proof
that represents the relationship between
and
. The DO sends
,
,
,
, and
to the DU. The DU executes the algorithm
in [
32] to verify
. Similarly, the DU executes the algorithm
to verify
,
, and
. If any equation
,
, or
, or
is satisfied, it means that
. Finally, the DU can determine whether the CS has correctly executed the query process.
Note that a Bloom filter is adopted in the above verification process. The Bloom filter can provide fast verification and relatively high accuracy to prove that . However, considering that the Bloom filter may have a very low probability of false positive errors occurring, a cryptographic multiset accumulator is adopted in our scheme EVRQ. By combining the Bloom filter and cryptographic multiset accumulator, EVRQ ensures the efficiency of the verification and the correctness of the query process.
Suppose (1) is the ciphertext of the POI queried by the DU; (2) is located in the MR that is associated with the leaf node ; (3) , , , and are sibling nodes; (4) N is the parent node of , , , and ; (5) the POIs of , , and are not covered by the queried range Q. The DU requests , , , , and of the node from the CS. By verifying whether is equal to , the DU can determine whether the CS has illegally modified the information of or provided incorrect information to the DU. Then, the DU requests the hash values , , and stored in , , and , respectively, and , , and stored in N. Next, the DU calculates the hash value . Using this method in a bottom–up manner iteratively, the DU calculates the hash values of the ancestor nodes of . Finally, the DU tests whether the computed hash value of the root node is equal to the hash value stored in the root node of the MRT index. If they are equal, it indicates that the CS has honestly provided all the information and executed the range query’s entirety.